CVE-2026-118652

Echo is a Go web framework. Prior to 4.16.0 and 5.4.0, Context.JSONP and Context.JSONPBlob concatenate an unvalidated callback value into a JavaScript response. A route that passes attacker-controlled input as the callback can return executable script syntax, allowing reflected cross-site scripting when a user loads the crafted response. The vulnerable jsonPBlob path performs no callback validation or escaping, and exploitation requires an application route that exposes attacker control over the callback argument. This issue is fixed in 4.16.0 and 5.4.0.

• CWE-79

• https://github.com/labstack/echo/commit/b838391e2eade87ae7e5a09d7bb5087bec271ec1
• https://github.com/labstack/echo/commit/fc410094b2f3415cf2bf5204082137b205bfd5af
• https://github.com/labstack/echo/releases/tag/v4.16.0
• https://github.com/labstack/echo/releases/tag/v5.4.0
• https://github.com/labstack/echo/security/advisories/GHSA-h9g5-28mm-hx3g

Published

Oct 28, 2026

Last Modified

Oct 29, 2026

Status

Awaiting Analysis

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-118646n8n before 1.123.85, 2.43.5, and 2.44.1 contains a regular e…6.5
• CVE-2026-118647n8n before 1.123.85, 2.x before 2.43.5, and 2.44.x before 2.…8.2
• CVE-2026-118648n8n before 1.123.85, 2.x before 2.43.5, and 2.44.x before 2.…7.3
• CVE-2026-118649n8n before 2.43.5 and 2.44.x before 2.44.1 accepts a client-…8.3
• CVE-2026-118650Echo is a Go web framework. Prior to 4.16.0 and 5.4.0, a glo…7.5
• CVE-2026-118651Echo is a Go web framework. From 4.0.0 until 5.4.0, the Prox…5.3
• CVE-2026-118653Echo is a Go web framework. From 4.0.0 until 5.1.0, Context.…5.3
• CVE-2026-118654Echo is a Go web framework. Prior to 4.16.0 and 5.4.0, Echo'…5.9
• CVE-2026-118655Echo is a Go web framework. Prior to 4.15.3 and 5.2.0, middl…5.9
• CVE-2026-118656Echo is a Go web framework. Prior to 4.16.0 and 5.4.0, sanit…6.1
• CVE-2026-118657Echo is a Go web framework. Prior to 4.16.0 and 5.4.0, Conte…5.9
• CVE-2026-118658Echo is a Go web framework. Prior to 4.15.2 and 5.1.1, Conte…4.7